bumblebee | 8ef540dba9d6f21332f766ea513a8bd249c346773ae58106d7682ce40bb37e0e

Analysis

max time kernel
199s
max time network
215s
platform
windows7_x64
resource
win7-20220812-de
resource tags

arch:x64arch:x86image:win7-20220812-delocale:de-deos:windows7-x64systemwindows
submitted
10-11-2022 10:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ini.bat
Size

54B
MD5

1569f10208cb9da7614262b3a8218ee0
SHA1

8af330c88518cd43ba9cd509f5a7c894c4c95018
SHA256

f418b9c6fbca29c793d0c114b792caea62da10090b4b0cc5b9541af10dc9c874
SHA512

f0711d61100bafdd70bae19be085436dfce697ecef1e13c6eb4be5cc597843cd5deb6a4230a38aa0f68a8b60586819cd5f09d36d8a1c54530a6d61fce57e8af1

Score

10^/10

bumblebee 0311t2 trojan

Malware Config

Extracted

Family

bumblebee

Botnet

0311t2

39.65.8.170:443

103.144.139.156:443

107.189.30.231:443

91.245.254.101:443

194.135.33.127:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Blocklisted process makes network request 9 IoCs

flow	pid	Process
1	1796	rundll32.exe
3	1796	rundll32.exe
4	1796	rundll32.exe
5	1796	rundll32.exe
6	1796	rundll32.exe
7	1796	rundll32.exe
10	1796	rundll32.exe
13	1796	rundll32.exe
14	1796	rundll32.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1796	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 1796	1908	cmd.exe	29
PID 1908 wrote to memory of 1796	1908	cmd.exe	29
PID 1908 wrote to memory of 1796	1908	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\ini.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" /s bb.dll,BasicLoad
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  PID:1796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1796-55-0x0000000002220000-0x0000000002369000-memory.dmp

Filesize
1.3MB

Download
memory/1796-56-0x00000000001D0000-0x0000000000246000-memory.dmp

Filesize
472KB

Download